Hacker News Reader

Comment by rs186 | Hacker News Reader

> “I was panicking,” Jay Gibson, who asked that we don’t use his real name over fears of retaliation, told TechCrunch.

And later,

> Without a full forensic analysis of Gibson’s phone ... it’s impossible to know why he was targeted or who targeted him.

> But Gibson told TechCrunch that he believes the threat notification he received from Apple is connected to the circumstances of his departure from Trenchant ...

I find it funny that (1) this guy never thought this would happen to him (2) this guy has the balls to talk to media about this but fears retaliation

I mean, seriously, those who want to know your real name already know it.

View on HN

This honestly smells really strong like made up shit. Or the guy is very much a low key player.

Generally, if you develop exploits, you should be completely aware of every single possible attack vector. If you are working for a company like Trenchant, and you know what you are doing, the last thing you do is use Apple devices (at least fully, most of the time you have a public phone and much more secure private phone)

The reason is, when you take an Apple phone, connect it to a router that proxies through a computer so you can inspect traffic, you can see the vast amounts of shit being sent back to Apple which you have no control of.

Meanwhile, if you do the same with my custom rooted, de-googled android phone that I take overseas, you will see only ntp traffic, and that is only so I don't have to deal with cert issues because my clock is wrong.

Trenchant employees use iPhones just like everyone else. What else would they use?

Apple SRD devices.

> The SRD is intended for use in a controlled setting for security research only…The SRD isn't meant for personal use or daily carry, and must remain on the premises of program participants at all times.

(From https://security.apple.com/research-device)

Doubtful, if you find exploits using an SRD then you're expected to disclose them to Apple. None of these shops would have SRDs.

For anything that can be considered compromising, you dont use a smartphone.

Going public is presumably part of his strategy for trying not to be disappeared.

Reply on news.ycombinator.com